Configure-Host.ps1

& {

param(
    [Parameter(Mandatory = $true)][string]$UserName,
    [Parameter(Mandatory = $true)][string]$Password,
    [string]$Basic,
    [string]$Negotiate,
    [string]$AllowUnencrypted
)

$LangCode = "en-US"
$Steps = New-Object System.Collections.ArrayList

function Parse-Bool($value) {
    try {
        return [System.Convert]::ToBoolean($value.ToString().Trim())
    } catch {
        throw "Paramètre booléen invalide: '$value'"
    }
}

if (-not $Basic) {
    $Basic = Read-Host "Basic (true or false)"
}
if (-not $Negotiate) {
    $Negotiate = Read-Host "Negotiate (true or false)"
}
if (-not $AllowUnencrypted) {
    $AllowUnencrypted = Read-Host "AllowUnencrypted (true or false)"
}

$ParsedBasic = Parse-Bool $Basic
$ParsedNegotiate = Parse-Bool $Negotiate
$ParsedAllowUnencrypted = Parse-Bool $AllowUnencrypted

function Add-StepResult {
    param([string]$Name,[bool]$Ok,[string]$Msg="")
    $icon = if ($Ok) {"OK"} else {"KO"}
    $status = if ($Ok) {"Success"} else {"Failed"}
    [void]$Steps.Add([PSCustomObject]@{ Step=$Name; Status=$status; Message="$icon $Msg" })
}

function Execute-Step {
    param([string]$Name,[scriptblock]$Action)
    try {
        & $Action
        Add-StepResult -Name $Name -Ok $true -Msg "Étape réussie"
    } catch {
        Add-StepResult -Name $Name -Ok $false -Msg ("Erreur : " + $_.Exception.Message)
        throw "Étape $Name échouée"
    }
}

function Install-LanguageIfNeeded {
    param([string]$LangCode)
    Write-Host "[1/8] Installation de la langue $LangCode et configuration" -ForegroundColor Yellow
    try {
        Install-Language -Language $LangCode -ExcludeFeatures
    }
    catch {
        Write-Warning "Impossible d'installer la langue $LangCode. Veuillez l'installer par interface graphique depuis un compte admin"
    }
   
    $languages = Get-WinUserLanguageList
    if ($languages.LanguageTag -notcontains $LangCode) {
        Write-Host "Langue $LangCode non présente, ajout..." -ForegroundColor Gray
        $languages.Add($LangCode)
        Set-WinUserLanguageList $languages -Force
        Write-Host "Langue $LangCode ajoutée." -ForegroundColor Green
    } else {
        Write-Host "Langue $LangCode déjà disponible." -ForegroundColor Green
    }
    Write-Host ""
}

function Configure-WinRM {
    Write-Host "[2/8] Configuration rapide de WinRM" -ForegroundColor Yellow
    winrm quickconfig -q
    if ($LASTEXITCODE -ne 0) { throw "WinRM quickconfig a échoué ($LASTEXITCODE)" }
    Write-Host "WinRM configuré." -ForegroundColor Green
    Write-Host ""
}

function Add-UserToExistingGroup {
    param(
        [string]$UserName,
        [string]$PrimaryGroup,
        [string]$FallbackGroup
    )

    $groupUsed = $null

    foreach ($grp in @($PrimaryGroup,$FallbackGroup)) {
        $output = net localgroup "$grp" 2>$null
        if ($LASTEXITCODE -eq 0) {
            $groupUsed = $grp
            break
        }
    }

    if (-not $groupUsed) {
        throw "Aucun des groupes '$PrimaryGroup' ou '$FallbackGroup' n'existe."
    }

    if ($output -match "^\s*$UserName\s*$") {
        Write-Host "Utilisateur $UserName déjà dans le groupe $groupUsed" -ForegroundColor Gray
    } else {
        & net localgroup "$groupUsed" $UserName /ADD | Out-Null
        if ($LASTEXITCODE -ne 0) {
            throw "Échec ajout utilisateur $UserName dans le groupe $groupUsed ($LASTEXITCODE)"
        } else {
            Write-Host "Utilisateur $UserName ajouté au groupe $groupUsed" -ForegroundColor Green
        }
    }
}

function Create-User {
    param([string]$UserName, [string]$Password)

    Write-Host "[3/8] Création de l'utilisateur $UserName" -ForegroundColor Yellow

    $exists = net user $UserName 2>$null
    if ($LASTEXITCODE -ne 0) {
        & net user $UserName $Password /ADD | Out-Null
        if ($LASTEXITCODE -ne 0) {
            throw "Échec création utilisateur via 'net user' ($LASTEXITCODE)"
        }
    } else {
        Write-Host "Utilisateur déjà existant : $UserName" -ForegroundColor Gray
    }

    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Remote Management Users" -FallbackGroup "Utilisateurs de gestion à distance"
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Performance Monitor Users" -FallbackGroup "Utilisateurs de l’Analyseur de performances"

    $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
    $Credential = New-Object System.Management.Automation.PSCredential ($UserName, $SecurePassword)
    try {
        Start-Process -FilePath "whoami.exe" -Credential $Credential -WindowStyle Hidden -Wait
    } catch {
        Write-Host "⚠️ Impossible de lancer un logon test pour $UserName ($_)" -ForegroundColor Red
    }

    Write-Host "Utilisateur $UserName créé/validé et groupes assignés." -ForegroundColor Green
}


function Configure-UserLanguage {
    param(
        [string]$UserName,
        [string]$Password,
        [string]$LangCode
    )

    Write-Host "[4/8] Configuration de la langue pour l'utilisateur $UserName" -ForegroundColor Yellow

    $Computer = $env:COMPUTERNAME
    $SID = (Get-WmiObject Win32_UserAccount -Filter "Name='$UserName' AND Domain='$Computer'").SID
    if (-not $SID) { throw "Impossible de récupérer le SID pour $UserName" }

    $UserProfile = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
    if (-not $UserProfile) { throw "Profil introuvable pour $UserName" }

    $HivePath = Join-Path $UserProfile.LocalPath "NTUSER.DAT"
    if (-not (Test-Path $HivePath)) { throw "Profil non initialisé (NTUSER.DAT introuvable) : $HivePath" }

    $regRelative = "Control Panel\Desktop"
    $valueName = "PreferredUILanguages"
    [string[]]$LangArray = @($LangCode)

    $IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"
    if ($IsLoaded) {
        $fullPath = "Registry::HKEY_USERS\$SID\$regRelative"
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        if (-not (Get-ItemProperty -Path $fullPath -Name $valueName -ErrorAction SilentlyContinue)) {
            New-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
        } else {
            Set-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray
        }
    } else {
        Write-Host "Utilisateur non connecté. Chargement de la ruche..." -ForegroundColor Gray
        reg load "HKU\TempHive" $HivePath | Out-Null
        try {
            $tempPath = "Registry::HKEY_USERS\TempHive\$regRelative"
            if (-not (Test-Path $tempPath)) { New-Item -Path $tempPath -Force | Out-Null }
            if (-not (Get-ItemProperty -Path $tempPath -Name $valueName -ErrorAction SilentlyContinue)) {
                New-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
            } else {
                Set-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray
            }
        } finally {
            reg unload "HKU\TempHive" | Out-Null
            Write-Host "Ruche déchargée." -ForegroundColor Gray
        }
    }

    Write-Host "Langue préférée utilisateur définie sur $LangCode (REG_MULTI_SZ)." -ForegroundColor Green
}

function Configure-WinRMAuth {
    param([bool]$Basic, [bool]$Negotiate, [bool]$AllowUnencrypted)
 
    Write-Host "[5/8] Configuration de l'authentification WinRM" -ForegroundColor Yellow

    if (!$Basic -and !$Negotiate) {
        throw "Aucune méthode d'authentification n'est paramétrée. Veuillez choisir Basic ou Negotiate."
    }

    if ($Basic -and !$AllowUnencrypted) {
        throw "L'authentification Basic nécessite d'authoriser la connection non chiffré (AllowUnencrypted). Le support HTTPS n'est pas disponible pour le moment."
    }

    if (!$Basic -and $Negotiate -and $AllowUnencrypted) {
        throw "Negotiate ne nécessite pas une connection chiffré (AllowUnencrypted). Il est déconseillé de l'activer."
    }

    if ($Basic) {
        winrm set winrm/config/service/auth '@{Basic="true"}'
    }
    
    if ($Negotiate) {
        winrm set winrm/config/service/auth '@{Negotiate="true"}'
    }

    if ($AllowUnencrypted) {
        winrm set winrm/config/service '@{AllowUnencrypted="true"}'
    }

    Write-Host "Configuration d'authentification définie." -ForegroundColor Green
    Write-Host ""
}

function Configure-WinRMSDDL {
    param([string]$UserName)
    Write-Host "[6/8] Attribution des droits WinRM (SDDL)" -ForegroundColor Yellow
 
    $GENERIC_READ = 0x80000000
    $GENERIC_EXECUTE = 0x20000000
    $user_sid = (New-Object System.Security.Principal.NTAccount $UserName).Translate([System.Security.Principal.SecurityIdentifier])
 
    $sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value
    $sd = New-Object System.Security.AccessControl.CommonSecurityDescriptor $false, $false, $sddl
    $sd.DiscretionaryAcl.AddAccess(
        [System.Security.AccessControl.AccessControlType]::Allow,
        $user_sid,
        ($GENERIC_READ -bor $GENERIC_EXECUTE),
        [System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None
    )
    $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
    Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force
    Write-Host "Droits SDDL appliqués." -ForegroundColor Green
    Write-Host ""
}

Function Configure-CIMSDDL {
    param(
        [parameter(Mandatory=$true,Position=0)][string] $namespace,
        [parameter(Mandatory=$true,Position=1)][string] $operation,
        [parameter(Mandatory=$true,Position=2)][string] $account,
        [parameter(Position=3)][string[]] $permissions = $null,
        [bool] $allowInherit = $false,
        [bool] $deny = $false,
        [string] $computerName = ".",
        [System.Management.Automation.PSCredential] $credential = $null
    )
 
    Write-Host "[7/8] Attribution des droits WMI/CIM" -ForegroundColor Yellow
    $ErrorActionPreference = "Stop"
 
    Function Get-AccessMaskFromPermission($permissions) {
        $WBEM_ENABLE = 1
        $WBEM_METHOD_EXECUTE = 2
        $WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = 8
        $WBEM_WRITE_PROVIDER = 0x10
        $WBEM_REMOTE_ACCESS = 0x20
        $READ_CONTROL = 0x20000
        $WRITE_DAC = 0x40000
 
        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,
            $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,
            $READ_CONTROL,$WRITE_DAC
 
        $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",
            "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"
 
        $permissionTable = @{}
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
            $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }
 
        $accessMask = 0
        foreach ($permission in $permissions) {
            if (-not $permissionTable.ContainsKey($permission.ToLower())) {
                throw "Permission inconnue: $permission`nPermissions authorisées: $($permissionTable.Keys)"
            }
            $accessMask += $permissionTable[$permission.ToLower()]
        }
        $accessMask
    }
 
    if ($PSBoundParameters.ContainsKey("Credential")) {
        $remoteparams = @{ComputerName=$computerName;Credential=$credential}
    } else {
        $remoteparams = @{}
    }
 
    $invokeparams = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($output.ReturnValue -ne 0) {
        throw "GetSecurityDescriptor a échoué: $($output.ReturnValue)"
    }
 
    $acl = $output.Descriptor
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name
 
    if ($account.Contains('\')) {
        $domainaccount = $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq ".") -or ($domain -eq "BUILTIN")) {
            $domain = $computerName
        }
        $accountname = $domainaccount[1]
    } elseif ($account.Contains('@')) {
        $domainaccount = $account.Split('@')
        $domain = $domainaccount[1].Split('.')[0]
        $accountname = $domainaccount[0]
    } else {
        $domain = $computerName
        $accountname = $account
    }
 
    $getparams = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams
    $win32account = Get-WmiObject @getparams
    if ($null -eq $win32account) {
        throw "Compte utilisateur inconnu: $account"
    }
 
    switch ($operation) {
        "add" {
            if ($null -eq $permissions) {
                throw "Les permissions doivent être spécifié."
            }
 
            $accessMask = Get-AccessMaskFromPermission($permissions)
            $ace = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
            $ace.AccessMask = $accessMask
            $ace.AceFlags = if ($allowInherit) { $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG } else { 0 }
 
            $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
            $ace.Trustee = $trustee
            $ace.AceType = if ($deny) { 0x1 } else { 0x0 }
 
            $acl.DACL += $ace.psobject.immediateBaseObject
        }
        default {
            throw "Opération inconnue: $operation`nOpérations authorisés : add"
        }
    }
 
    $setparams = @{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output = Invoke-WmiMethod @setparams
    if ($output.ReturnValue -ne 0) {
        throw "SetSecurityDescriptor a échoué: $($output.ReturnValue)"
    }
}

function Configure-W32TimeSDDL {
    param([string]$UserName)
    Write-Host "[8/8] Attribution des droits sur W32Time" -ForegroundColor Yellow
 
    $sid = (New-Object System.Security.Principal.NTAccount($UserName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $currentSddl = & sc.exe sdshow w32time
    $newAce = "(A;;CCLCLO;;;${sid})"
    $newSddl = $currentSddl + $newAce
    sc.exe sdset w32time "$newSddl"
    Restart-Service w32time
 
    Write-Host "Droits W32Time appliqués pour $UserName." -ForegroundColor Green
    Write-Host ""
}

function Run-All-Steps {
    $LangCode = "en-US"

    try {
        Execute-Step "Langue en-US" { Install-LanguageIfNeeded -LangCode $LangCode }
        Execute-Step "WinRM quickconfig" { Configure-WinRM }
        Execute-Step "Création utilisateur + Ajout aux groupes" { Create-User -UserName $UserName -Password $Password }
        Execute-Step "Langue UI du profil" { Configure-UserLanguage -UserName $UserName -LangCode $LangCode }
        Execute-Step "WinRM Auth" { Configure-WinRMAuth $ParsedBasic $ParsedNegotiate $ParsedAllowUnencrypted }
        Execute-Step "WinRM RootSDDL" { Configure-WinRMSDDL -UserName $UserName }
        Execute-Step "WMI/CIM root\cimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/cimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "WMI/CIM root\standardcimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/standardcimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "W32Time SDDL" { Configure-W32TimeSDDL -UserName $UserName }
    } catch {
        Write-Host "$($_.Exception.Message)" -ForegroundColor Red
    }
}

function Configure {
    $Steps = New-Object System.Collections.ArrayList

    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host "CONFIGURE PACK [windows-by-WinRM] for supervised host" -ForegroundColor Cyan
    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host ""

    Run-All-Steps
    Write-Host ""
    Write-Host ("═" * 70) -ForegroundColor DarkGray
    Write-Host "RÉSUMÉ DES ÉTAPES" -ForegroundColor Yellow
    Write-Host ("═" * 70) -ForegroundColor DarkGray
        
    foreach ($s in $Steps) {
        if ($s.Status -eq "Success") {
            Write-Host ("[OK] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Green
        } else {
            Write-Host ("[KO] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Red
        }
    }
        
    Write-Host ("═" * 70) -ForegroundColor DarkGray
}

Configure

}